Medium 2 exploited CVEs ELSA-2022-7340 3 CVEs

Moderate: php-pear security update (Oracle Linux 7)

Published Nov 3, 2022 · Updated Nov 3, 2022

Ecosystem: Oracle Linux

Summary

[1:1.9.4-23]
- update Archive_Tar to 1.4.14
CVE-2020-36193 CVE-2020-28948 CVE-2020-28949

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 7	php-pear	1:1.9.4-23.el7_9

Vulnerabilities 3

High 7.8

CVE-2020-28949 Exploited Public exploit EPSS 85%

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrappe…

drupal7 drupal7 php-pear php-pear Debian Ubuntu Alpine

Nov 19, 2020
KEV Aug 25, 2022
High 7.5

CVE-2020-36193 Exploited EPSS 71%

Directory Traversal in Archive_Tar

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

drupal7 php-pear php-pear pear/archive_tar Debian Ubuntu Alpine Packagist

Jan 18, 2021
KEV Aug 25, 2022
High 7.8

CVE-2020-28948 Public exploit EPSS 47%

Multiple vulnerabilities through filename manipulation in Archive_Tar

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

drupal/core drupal7 drupal7 php-pear Debian Ubuntu Alpine Packagist

Nov 19, 2020